Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Managing Yandex StoreDoc users

Written by
Updated at September 1, 2026
View in Markdown

You can add and remove users, manage individual user settings, and change database access permissions.

Getting a list of users

  1. In the management console, select a folder.
  2. Navigate to Yandex StoreDoc.
  3. Locate the cluster you need in the list, click its name, and select the  Users tab.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To get a list of cluster users, run this command:

yc managed-mongodb user list \
  --cluster-name <cluster_name>

You can get the cluster name with the list of clusters in the folder.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Call the User.List method, e.g., via the following cURL request:

    curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users'

    You can get the cluster ID with the list of clusters in the folder.

  3. Check the server response to make sure your request was successful.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Call the UserService.List method, e.g., via the following gRPCurl request:

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "cluster_id": "<cluster_ID>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.mongodb.v1.UserService.List

    You can get the cluster ID with the list of clusters in the folder.

  4. Check the server response to make sure your request was successful.

Getting user info

  1. In the management console, select a folder.

  2. Navigate to Yandex StoreDoc.

  3. Locate the cluster you need in the list, click its name, and select the  Users tab.

    User information is available in the user list.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To get information about a specific user:

  1. See the description of the CLI command for getting user info:

    yc managed-mongodb user get --help

  2. Get user info by running this command:

    yc managed-mongodb user get <username> \
  --cluster-id=<cluster_ID>

    You can get the username with the list of users in the cluster, and the cluster ID, with the list of clusters in the folder.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Call the User.Get method, e.g., via the following cURL request:

    curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users/<username>'

    You can get the cluster ID with the list of clusters in the folder, and the username, with the list of users in the cluster.

  3. Check the server response to make sure your request was successful.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Call the UserService.Get method, e.g., via the following gRPCurl request:

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
    "cluster_id": "<cluster_ID>",
    "user_name": "<username>"
  }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.mongodb.v1.UserService.Get

    You can get the cluster ID with the list of clusters in the folder, and the username, with the list of users in the cluster.

  4. Check the server response to make sure your request was successful.

Creating a user

  1. In the management console, select a folder.

  2. Navigate to Yandex StoreDoc.

  3. Click the cluster name and open the  Users tab.

  4. Click Create user.

  5. Choose the authorization method:

    • Password: Authorization by username and password.

      For this authorization method, enter the username and password.

      Note

      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.

      The password must be between 8 and 128 characters.

    • IAM: Authroization using a Yandex account, federated account, or local account.

      For this authorization method, select the account in the User field.

  6. Configure the user’s roles:

    1. Click Add database and select the database for role assignment.
    2. Add roles using the button.

    You can assign a user multiple roles across different databases.

  7. Click Create.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To create a cluster user:

  1. See the description of the CLI command for creating a user:

    yc managed-mongodb user create --help

  2. Specify user properties in the creation command:

    yc managed-mongodb user create <username> \
  --cluster-name <cluster_name> \
  --password <user_password> \
  --permission database=<DB_name>,role=<role>,role=<other_role>,... \
  --permission database=<other_DB_name>,role=<role>,... \
  --deletion-protection=<protect_user_from_deletion>

    Where:

    • <username>, --password: Username and password.

      Note

      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.

      The password must be between 8 and 128 characters.

    • --cluster-name: Cluster name you can request with the list of clusters in the folder.

    • --permission: User’s database access permissions:

      • database: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • role: User’s role in the database. For the list of possible values, see Users and roles.

        A user can get several roles in a database. Specify each one in a separate role property.

      Specify a separate --permission property for each database you want the user to access.

    • --deletion-protection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  1. Open the current Terraform configuration file with the infrastructure plan.

    To learn how to create this file, see Creating a cluster.

  2. Add the yandex_mdb_mongodb_user resource:

    resource "yandex_mdb_mongodb_user" "<username>" {
  cluster_id          = <cluster_ID>
  name                = "<username>"
  password            = "<password>"
  deletion_protection = <protect_user_from_deletion>
  permission {
    database_name = "<DB_name>"
    roles         = [ "<list_of_user_roles>" ]
  }
}

    Where:

    • cluster_id: Cluster ID you can request with the list of clusters in the folder.

    • name, password: Username and password.

      Note

      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.

      The password must be between 8 and 128 characters.

    • deletion_protection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

    • permission: User’s database access permissions:

  3. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  4. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Call the User.Create method, e.g., via the following cURL request:

    curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users' \
  --data '{
            "userSpec": {
              "name": "<username>",
              "password": "<user_password>",
              "permissions": [
                {
                  "databaseName": "<DB_name>",
                  "roles": [
                   "<role_1>", "<role_2>", ..., "<role_N>"
                  ]
                }
              ],
              "deletionProtection": <protect_user_from_deletion>
            }
          }'

    Where:

    • <cluster_ID>: Cluster ID you can request with the list of clusters in the folder.

    • userSpec.name, userSpec.password: Username and password.

      Note

      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.

      The password must be between 8 and 128 characters.

    • userSpec.permissions: User permissions:

      • databaseName: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • roles: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see Users and roles.

      In the permissions array, add a separate element with permission settings for each database.

    • userSpec.deletionProtection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  3. Check the server response to make sure your request was successful.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Call the UserService.Create method, e.g., via the following gRPCurl request:

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "cluster_id": "<cluster_ID>",
        "user_spec": {
          "name": "<username>",
          "password": "<user_password>",
          "permissions": [
            {
              "database_name": "<DB_name>",
              "roles": [
                 "<role_1>", "<role_2>", ..., "<role_N>"
              ]   
            }
          ],
          "deletion_protection": <protect_user_from_deletion>
        }
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.mongodb.v1.UserService.Create

    Where:

    • cluster_id: Cluster ID you can request with the list of clusters in the folder.

    • user_spec.name, user_spec.password: Username and password.

      Note

      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.

      The password must be between 8 and 128 characters.

    • user_spec.permissions: User permissions:

      • database_name: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • roles: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see Users and roles.

      In the permissions array, add a separate element with permission settings for each database.

    • user_spec.deletion_protection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  4. Check the server response to make sure your request was successful.

Changing user settings

Note

You cannot change the username.

  1. In the management console, select a folder.

  2. Navigate to Yandex StoreDoc.

  3. Click the cluster name and open the  Users tab.

  4. To change a user’s password, locate the user in the list, click in their row, and select Change password.

    • Enter manually: Set your own password. It must be from 8 to 128 characters long.

    • Generate: Generate a password using Connection Manager.

      To view the new password, navigate to the cluster page, select the Users tab, and click View password for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as Current.

    To view passwords, you need the lockbox.payloadViewer role.

  5. To change the user's roles:

    1. Locate the user you need in the list, click in their row, and select Configure.
    2. To add a role, click next to the target database and select the role you want to assign.
    3. To delete a role, click next to its name.

  6. Click Save.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To change the user settings:

  1. See the description of the CLI command for updating a user:

    yc managed-mongodb user update --help

  2. Specify user properties in the update command:

    yc managed-mongodb user update <username> \
  --cluster-name <cluster_name> \
  --password <user_password> \
  --permission database=<DB_name>,role=<role>,role=<other_role>,... \
  --permission database=<other_DB_name>,role=<role>,... \
  --deletion-protection=<protect_user_from_deletion>

    Where:

    • <username>: Username you can request with the list of users in the cluster.

    • --cluster-name: Cluster name you can request with the list of clusters in the folder.

    • --password: Password.

      The password must be from 8 to 128 characters long.

    • --permission: User’s database access permissions:

      • database: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • role: User’s role in the database. For the list of possible values, see Users and roles.

        A user can get several roles in a database. Specify each one in a separate role property.

      Specify a separate --permission property for each database you want the user to access.

    • --deletion-protection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

To grant a user access to a database with a specific set of roles:

  1. See the description of the CLI command for granting user permissions:

    yc managed-mongodb user grant-permission --help

  2. Specify user properties in the user grant permission command:

    yc managed-mongodb user grant-permission <username> \
  --cluster-name <cluster_name> \
  --database <DB_name> \
  --role <list_of_roles_separated_by_commas>

To revoke database access from a user:

  1. See the description of the CLI command for revoking user permissions:

    yc managed-mongodb user revoke-permission --help

  2. Specify user properties in the user revoke permission command:

    yc managed-mongodb user revoke-permission <username> \
  --cluster-name <cluster_name> \
  --database <DB_name>

    This command revokes the user’s access to the specified database.

You can get the cluster’s name from the list of clusters in your folder, the database name from the list of your cluster databases, and the user's name from the list of cluster users.

  1. Open the current Terraform configuration file with the infrastructure plan.

    To learn how to create this file, see Creating a cluster.

  2. Locate the yandex_mdb_mongodb_user resource.

  3. To set a new password, edit the password field value:

    resource "yandex_mdb_mongodb_user" "<username>" {
  ...
  password   = "<new_password>"
  ...
}

    The password must be from 8 to 128 characters long.

  4. To set up permissions for the user, update the list of roles in the roles field:

    resource "yandex_mdb_mongodb_user" "<username>" {
  ...
  permission {
    database_name = "<DB_name>"
    roles         = [ "<new_list_of_user_roles>" ]
  }
  ...
}

    For the list of possible roles, see Users and roles.

  5. To enable or disable user protection from accidental deletion, update the deletion_protection field value:

    resource "yandex_mdb_mongodb_user" "<username>" {
  ...
  deletion_protection = <protect_user_from_deletion>
  ...
}

    Where deletion_protection stands for user protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  6. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  7. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Call the User.Update method, e.g., via the following cURL request:

    Warning

    The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

    curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users/<username>' \
  --data '{
           "updateMask": "password,permissions.databaseName,permissions.roles,deletionProtection",
           "password": "<user_password>",
           "permissions": [
             {
               "databaseName": "<DB_name>",
               "roles": [
                 "<role_1>", "<role_2>", ..., "<role_N>"
               ]
             }
           ],
           "deletionProtection": <protect_user_from_deletion>
         }'

    Where:

    • <cluster_ID>: Cluster ID you can request with the list of clusters in the folder.

    • <username>: Username you can request with the list of users in the cluster.

    • updateMask: Comma-separated string of settings to update.

    • password: Password.

      The password must be from 8 to 128 characters long.

    • permissions: User permissions:

      • databaseName: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • roles: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see Users and roles.

    • deletionProtection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  3. Check the server response to make sure your request was successful.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Call the UserService.Update method, e.g., via the following gRPCurl request:

    Warning

    The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

    Format for listing settings
    "update_mask": {
    "paths": [
        "<setting_1>",
        "<setting_2>",
        ...
        "<setting_N>"
    ]
}

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>",
        "update_mask": {
          "paths": [
            "password",
            "permissions.database_name",
            "permissions.roles",
            "deletion_protection"
          ]
        },
        "password": "<user_password>",
        "permissions": [
          {
            "database_name": "<DB_name>",
            "roles": [
              "<role_1>", "<role_2>", ..., "<role_N>"
            ]
          }
        ],
        "deletion_protection": <protect_user_from_deletion>
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.mongodb.v1.UserService.Update

    Where:

    • cluster_id: Cluster ID you can request with the list of clusters in the folder.

    • user_name: Username you can request with the list of users in the cluster.

    • update_mask: List of settings to update as an array of strings (paths[]).

    • password: Password.

      The password must be from 8 to 128 characters long.

    • permissions: User permissions:

      • database_name: Name of the database the user can access.

        You can request the database name with the list of databases in the cluster.

      • roles: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see Users and roles.

    • deletion_protection: User protection from accidental deletion, true or false. There is no default value; the user will use the one from the corresponding cluster setting. If the protection is enabled (true), you cannot delete the user.

  4. Check the server response to make sure your request was successful.

Deleting a user

Note

Before you delete a user, disable their deletion protection.

  1. In the management console, select a folder.
  2. Navigate to Yandex StoreDoc.
  3. Click the cluster name and open the  Users tab.
  4. Locate the user you need in the list, click in their row, and select Delete.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To delete a user, run this command:

yc managed-mongodb user delete <username> \
  --cluster-name <cluster_name>

You can get the cluster name with the list of clusters in the folder.

  1. Open the current Terraform configuration file with the infrastructure plan.

    To learn how to create this file, see Creating a cluster.

  2. Delete the yandex_mdb_mongodb_user resource with the target user’s description.

  3. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  4. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Call the User.Delete method, e.g., via the following cURL request:

    curl \
  --request DELETE \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users/<username>'

    You can get the cluster ID from the list of clusters in your folder, and the username from the list of cluster users.

  3. Check the server response to make sure your request was successful.

  1. Get an IAM token for API authentication and put it into an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Call the UserService.Delete method, e.g., via the following gRPCurl request:

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.mongodb.v1.UserService.Delete

    You can get the cluster ID from the list of clusters in your folder, and the username from the list of cluster users.

  4. Check the server response to make sure your request was successful.

Examples

Add a user with read-only permissions

To add a new user2 account with read-only access for the db1 database to an existing cluster:

  1. In the management console, select a folder.
  2. Navigate to Yandex StoreDoc.
  3. Click the cluster name and open the  Users tab.
  4. Click Create user.
  5. Enter user2 for username and enter a password (from 8 to 128 characters).
  6. Select the db1 database from the Add database drop-down list.
  7. Select the read role from the drop-down list next to the db1 database.
  8. Click Create.

Run this command:

yc managed-mongodb user create user2 \
  --cluster-name <cluster_name> \
  --password <user_password> \
  --permission database=db1,role=read \
  --deletion-protection=true

  1. Open the current Terraform configuration file with the infrastructure plan.

    For information on how to create this file, see Creating a cluster.

  2. Add the yandex_mdb_mongodb_user resource:

    resource "yandex_mdb_mongodb_user" "user2" {
  cluster_id          = <cluster_ID>
  name                = "user2"
  password            = "<password>"
  deletion_protection = true
  permission {
    database_name = "db1"
    roles         = [ "read" ]
  }
}

  3. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  4. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

Modify user permissions

To grant read-only access to the db2 database to an existing cluster1 user named user1:

  1. In the management console, select a folder.
  2. Navigate to Yandex StoreDoc.
  3. Click cluster1 and select the Users tab.
  4. Click in the row with user1 and select Configure.
  5. Click Add database and select db2 as your database.
  6. Click and select the read role from the drop-down list next to the db2 database.
  7. Click Save.

Run this command:

yc managed-mongodb user grant-permission user1 \
  --cluster-name cluster1 \
  --database db2 \
  --role read

  1. Open the current Terraform configuration file with the infrastructure plan.

    For information on how to create this file, see Creating a cluster.

  2. Locate the yandex_mdb_mongodb_user resource.

  3. Add the permission section:

    resource "yandex_mdb_mongodb_user" "user1" {
  cluster_id          = <cluster_ID>
  name                = "user1"
  password            = "<password>"
  deletion_protection = true
  permission {
    database_name = "db2"
    roles         = [ "read" ]
  }
}

  4. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  5. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

Previous
Managing databases
Next
Managing shards